18

I am having trouble with this code. It breaks at the free(q->izv) function and i get a debug error saying:

CRT detected that the application wrote to memory after end of heap buffer

I have no idea what that means so i would be grateful for any help I get.

    typedef struct izvodjaci{
        char *izv;
        int broj;
        struct izvodjaci *sled;
    }IZV;

    obrisi_i(IZV *p){
        while (p){
            IZV *q;
            q = p;
            p = p->sled;
            if (!strcmp(q->izv,"UNKNOWN")) free(q->izv);
            free(q);
        }
    }

Thanks in advance

trincot
  • 317,000
  • 35
  • 244
  • 286
user3699827
  • 183
  • 1
  • 1
  • 5
  • 1
    Chances are this is just where the buffer overflow is just detected and not where it actually occurs. Try to reduce your entire code to a small sample that replicates the issue and post it here, assuming you don't find the issue first. – uesp Jun 04 '14 at 14:14

1 Answers1

39

What does “CRT detected that the application wrote to memory after end of heap buffer” mean?

Suppose you allocate a heap buffer:

char* buffer = malloc(5);

OK, buffer now points to five chars on the heap.

Suppose you write six chars into that buffer:

buffer[0] = 'a';
buffer[1] = 'b';
buffer[2] = 'c';
buffer[3] = 'd';
buffer[4] = 'e';
buffer[5] = '\0';

You have now corrupted the heap; you were only allowed to write five chars and you wrote six.

The program is now permitted to do anything whatsoever. It can work normally, it can crash, it can send all your passwords to hackers in China, anything.

Your implementation apparently chooses the best possible choice, which is "inform you that you made a mistake". You should be very, very happy that this is what happened, instead of any of the horrible alternatives. Unfortunately it informs you when the buffer is freed, and not when you made the mistake, but be happy that you got an error at all.

Eric Lippert
  • 647,829
  • 179
  • 1,238
  • 2,067
  • Thank you. You were right. I miscalculated and i used one space more than i allocated. – user3699827 Jun 05 '14 at 09:56
  • I rewrote almost everything except that... This is the first time i made that mistake so i haven't seen that error message before so i kinda panicked.And thanks for the tips. – user3699827 Jun 05 '14 at 10:05
  • Hi Eric, this was amazing. I kinda used strlen while copying from src char* to dest char*. Can you tell me why Visual Studio compiler finds this corruption issue during free, instead of while I ended up writing out of the memory bounds. – saurabheights Apr 22 '15 at 19:31
  • 1
    @user1874627: This is a question-and-answer site for specific questions about actual code, and what you've got there is a specific question about actual code, so I encourage you to (1) search to see if it is answered already, and if not (2) post a question! – Eric Lippert Apr 22 '15 at 20:40
  • @user1874627: That said, think about it like this: suppose you are developing a compiler for a C-like language. Describe to me how you would implement the feature you are suggesting: detection of out-of-bounds writes to an arbitrary place in an arbitrary memory buffer at the time of writing. The feature cannot be implemented by *magic*; you have to generate *code* for it. What would that code look like? It doesn't have to be at the assembly code level; try describing it in terms of a high-level language. – Eric Lippert Apr 22 '15 at 20:43
  • 1
    @user1874627: If you're having trouble getting started, here's an easier problem. Suppose you were generating code for detection of out-of-bounds writes to an arbitrary offset in a memory buffer, **but you know that the offset is from the start of the buffer**. How would you write the out-of-bounds-on-write detection in that case? Both problems are solvable but this one is much easier. – Eric Lippert Apr 22 '15 at 20:48